Upgrade glob to v11 to fix minimatch ReDoS vulnerability#1936
Merged
Conversation
Co-authored-by: azu <19714+azu@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix vulnerable dependency in glob due to minimatch
Upgrade glob to v11 to fix minimatch ReDoS vulnerability
Feb 21, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR upgrades the glob package from v10.5.0 to v11.1.0 to address a ReDoS (Regular Expression Denial of Service) vulnerability in the minimatch dependency (GHSA-3ppc-4f35-3m26). The vulnerable minimatch v9 used by glob v10 has been replaced with the patched minimatch v10.2.1 that comes with glob v11. Additionally, the @types/glob package has been removed since glob v11 ships with built-in TypeScript definitions.
Changes:
- Updated glob dependency from ^10.5.0 to ^11.1.0 in packages/textlint/package.json
- Removed
@types/globdevDependency as it's no longer needed - Updated pnpm-lock.yaml to reflect the new glob version and its dependencies, including minimatch v10.2.1
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| packages/textlint/package.json | Updated glob to ^11.1.0 and removed @types/glob from devDependencies |
| pnpm-lock.yaml | Updated lock file with glob v11.1.0, minimatch v10.2.1, and removed obsolete type definitions |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Merged
azu
added a commit
that referenced
this pull request
Feb 21, 2026
<!-- Release notes generated using configuration in .github/release.yml at master --> ## What's Changed ### CI * chore(deps): update github/codeql-action action to v3.31.10 by @renovate[bot] in #1902 * chore(deps): update rossjrw/pr-preview-action action to v1.8.1 by @renovate[bot] in #1907 * chore(deps): update github/codeql-action action to v3.31.11 by @renovate[bot] in #1911 * chore(deps): update github/codeql-action action to v3.32.0 by @renovate[bot] in #1913 * fix(website): use github-actions[bot] as deploy committer by @azu in #1918 * chore(deps): update github/codeql-action action to v3.32.1 by @renovate[bot] in #1919 * chore(deps): update github/codeql-action action to v3.32.2 by @renovate[bot] in #1924 * chore(deps): update github/codeql-action action to v3.32.3 by @renovate[bot] in #1933 ### Dependency Updates * chore(deps): update pnpm to v10.28.1 by @renovate[bot] in #1903 * chore(deps): update eslint to ^8.53.1 (patch) by @renovate[bot] in #1904 * fix(deps): update dependency @modelcontextprotocol/sdk to ^1.25.3 by @renovate[bot] in #1905 * fix(deps): update dependency lodash to ^4.17.23 by @renovate[bot] in #1906 * chore(deps): update pnpm to v10.28.2 by @renovate[bot] in #1908 * chore(deps): update eslint to ^8.54.0 (minor) by @renovate[bot] in #1909 * fix(deps): update react monorepo to ^19.2.4 (patch) by @renovate[bot] in #1910 * fix(deps): update babel monorepo to ^7.29.0 (minor) by @renovate[bot] in #1912 * chore(deps): update dependency @types/node to ^24.10.10 by @renovate[bot] in #1914 * fix(deps): update dependency @modelcontextprotocol/sdk to ^1.26.0 by @renovate[bot] in #1915 * chore(deps): update dependency @types/react to ^18.3.28 by @renovate[bot] in #1916 * chore(deps): update dependency @types/node to ^24.10.11 by @renovate[bot] in #1917 * chore(deps): update pnpm to v10.29.1 by @renovate[bot] in #1920 * chore(deps): update dependency @types/node to ^24.10.12 by @renovate[bot] in #1921 * chore(deps): update pnpm to v10.29.2 by @renovate[bot] in #1922 * chore(deps): update eslint to ^8.55.0 (minor) by @renovate[bot] in #1923 * chore(deps): update dependency lerna to ^9.0.4 by @renovate[bot] in #1926 * chore(deps): update dependency @types/node to ^24.10.13 by @renovate[bot] in #1925 * chore(deps): update pnpm to v10.29.3 by @renovate[bot] in #1929 * chore(deps): update dependency ajv to ^8.18.0 by @renovate[bot] in #1930 * chore(deps): update dependency rimraf to ^6.1.3 by @renovate[bot] in #1931 * chore(deps): update eslint to ^8.56.0 (minor) by @renovate[bot] in #1932 * chore(deps): update pnpm to v10.30.0 by @renovate[bot] in #1935 ### Other Changes * Upgrade glob to v11 to fix minimatch ReDoS vulnerability by @Copilot in #1936 **Full Changelog**: v15.5.1...v15.5.2 Co-authored-by: azu <azu@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
glob v10 depends on minimatch v9, which has a ReDoS vulnerability (CVE-2026-26996, GHSA-3ppc-4f35-3m26). Patterns with many consecutive asterisks followed by non-matching literals cause exponential backtracking.
Changes
^10.5.0→^11.1.0inpackages/textlint/package.jsonOriginal prompt
🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.